Privacy Policy

1. Overview

This Privacy Policy explains how [Legal Entity Name] ("EntBox", "we") collects, uses, and shares information when you use the EntBox AI platform (the "Service"). By using the Service you agree to the practices described here. [Confirm the controller entity and any regional representatives.]

2. Information we collect

• Account information — name, email, organization, and credentials you provide at sign-up.
• Usage & billing data — runs, rentals, compute/storage metering, and credit-ledger records.
• Customer Content — prompts, files, models, and outputs you submit or generate.
• Technical data — IP address, device/browser info, and log data needed to operate and secure the Service.
• Virtual machine data — the SSH public key you give us for each virtual machine, whether you chose the browser terminal key, and a log of who opened each browser terminal or console session, when, and for how long. See section 8.
• Local storage & cookies — see section 4.

3. How we use information

To provide, secure, meter, and bill the Service; to authenticate you; to communicate about your account (verification, password resets, service notices); to prevent abuse; and to comply with law. [State clearly whether Customer Content is used to train models — recommended default: it is not.]

4. Cookies & local storage

The Service uses browser local storage and/or cookies that are strictly necessary to keep you signed in and to remember preferences (such as your consent choice). When you rent a virtual machine, your browser also remembers the last SSH public key you entered and whether you ticked Add the browser terminal key, so the form is filled in next time. These stay on your device. [If you add analytics or non-essential cookies, describe them and honour the consent banner accordingly.] You can clear this storage in your browser at any time; doing so will sign you out.

5. How we share information

We share information with service providers who help us run the Service, for example: email delivery ([SMTP2GO]), cloud/on-prem infrastructure, and any third-party model providers your workloads invoke. We may disclose information to comply with law or protect rights and safety. We do not sell your personal information. [List sub-processors and link a sub-processor page.]

6. Data retention

We keep information only as long as we need it to run the Service, bill you, keep it secure, and meet our legal obligations:

• Account information — while your account is open. If you ask us to close your account, we delete it within 30 days, except for the billing records below.
• Customer Content (chats, files, buckets, workflows, uploaded models, and their outputs) — until you delete it, or until we close your account, when we delete it within 30 days.
• Billing and credit records — 7 years from the transaction, for tax and accounting.
• Usage records and activity logs (runs, rentals, and each rental’s activity log, including browser terminal and console sessions) — while your account is open, then deleted with it, except where they form part of your billing records.
• Virtual machines — when you release a virtual machine, we delete it, its disk, and our terminal key straight away. If your balance runs out, we power it off and keep its disk for 72 hours; if you don’t top up in that time, we delete it.
• API usage metering (request and token counts for your rental API keys) — 90 days.
• Server logs (IP addresses, browser details, and request logs) — 90 days.
• Backups — we back up our database every 6 hours and keep each backup for 7 days, so information you delete can remain in backups for up to 7 days after that.
• Sign-in sessions and email links — a sign-in session lasts 24 hours. Email verification links expire after 48 hours, password reset links after 1 hour, and invitation links after 72 hours.
• Local storage on your device — until you clear it in your browser (see section 4).

7. Security

We use technical and organizational measures to protect information, including encryption in transit, access controls, and tenant isolation. No system is perfectly secure. [Describe your security posture and breach-notification commitment.]

8. Virtual machines, browser terminal & console access

To power the browser terminal (the Open terminal button in Assets), we add an EntBox key to each new virtual machine you rent with the terminal key turned on. It appears in ~/.ssh/authorized_keys as the line ending in entbox-cloud-shell. Each virtual machine gets its own key, and our copy is stored encrypted.

When you rent a virtual machine, the Add the browser terminal key box is ticked by default. Untick it to keep the virtual machine SSH-only: we then create no EntBox key for it, it has no browser terminal, and the terminal can’t be added later.

We use this key only to connect browser terminal sessions that you, or members of your account, open from the portal, and to remove the key when you ask us to. We relay what you type and what the terminal shows while the session is open, but we don’t record it. We log who opened each session, when, and for how long, in that virtual machine’s activity log.

You can remove our access at any time. In Assets, open How to connect for the virtual machine and choose Turn off browser terminal. We then remove the key line from the virtual machine, delete our copy, and close any open terminal. You can also delete the line yourself. When you release a virtual machine, it, its disk and our key are deleted.

Each virtual machine also has a browser console (the Open console button in Assets). It shows the virtual machine’s screen and sends your keyboard and mouse to it, as if a monitor and keyboard were plugged in. It needs no key: we add nothing to the virtual machine, and you log in with a password you set on it yourself. Our images come with no password, so until you set one, the console shows the screen but can’t be used to log in.

While a console session is open, we relay the screen to your browser and your keyboard and mouse to the virtual machine, but we don’t record them. We log who opened each session, when, and for how long, in that virtual machine’s activity log. We don’t open your console ourselves unless you ask us to, for example for support. See also section 7 of our Terms of Service.

9. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact [privacy@enterprisebox.ai]. [Describe your self-service export/deletion options and response timelines; note GDPR/CCPA specifics as applicable.]

10. International transfers

Your information may be processed in [country/region]. Where required, we use appropriate safeguards for cross-border transfers. [Specify mechanisms such as SCCs if relevant.]

11. Children

The Service is not directed to children under [16], and we do not knowingly collect their personal data.

12. Changes

We may update this Policy. Material changes will be communicated by [email / in-app notice], with the "Last updated" date revised above.

13. Contact

Privacy questions or requests: [privacy@enterprisebox.ai] (placeholder — set a monitored address and, if required, a Data Protection Officer / EU representative).